# Error while replacing self-signed certificate with CA certificate in FAST server

I am trying to replace the self-signed certificate used while installing / configuring FAST server with a new certificate issues by my CA authority. I am following the tecnet article http://technet.microsoft.com/en-us/library/ff381244. I verified that the new CA certificate is installed in local and Trusted certificate store. However when I try to run the command:

.\ReplaceDefaultCertificate.ps1 -thumbprint "98 3c......"


I get the following error:

Error trying to check if FASTSearchAdministrators has access to certificate At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:597 char:13
+ CategoryInfo          : OperationStopped: (Error trying to... to certificate:String) [], RuntimeException

Error trying to run one of 'netsh http add sslcert ipport=0.0.0.0:13258/13271/13391 certhash=<given_thumbprintid> appid={a5455c78-6489-4e13-b395-47fbdee0e7e6}
clientcertnegotiation=enable'
At D:\FASTSearch\installer\scripts\include\certificatesharedfunctions.ps1:432 char:13


I verified that the user with which I am running the command is a part of local administrators group. Also when I try to run the command

.\SecureFASTSearchConnector.ps1 -ssaName "FAST Content SSA" -username "mycompany.com\myserviceaccount"


I get the error

No valid certificate found to configure your SSA. Exiting.


When I try to run the command

Ping-SPEnterpriseSearchContentService –HostName "MYSERVER.MYDOMAIN.COM"


I got False for each entry. Any help would be appreciated.

-

I have never touched FAST server but from the point of common sense and having configured and used code signing certificates...

I do not see where is "a new certificate issues by my CA authority" can be used by "following the tecnet article http://technet.microsoft.com/en-us/library/ff381244 "

That article describes situations of:

• replacing self-signed certificate by a 3d-party CA certificate
• or by another self-signed certificate

but not by your own one.

In the latter case, IMO, besides or before installing your own certificate you should enable, configure and run your own AD Certificate Services with some pitfalls that I found useful to know in advance

-

Do you have UAC enabled? If so, maybe try running the powershell prompt as administrator.

-
My powershell command prompt is running as administrator only. –  Ashish Jul 12 '12 at 12:31